The client 'abc' with object id 'XXXXXXXXXXXXXXXXXX' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourceGroups/read' over scope '/subscriptions/'XXXXXXXXXXXXXXXXXX'/resourceGroups/XXXX-014-aks-rg' or the scope is in

Question

The client 'abc' with object id 'XXXXXXXXXXXXXXXXXX' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourceGroups/read' over scope '/subscriptions/'XXXXXXXXXXXXXXXXXX'/resourceGroups/XXXX-014-aks-rg' or the scope is in

Deepanshu katara 16,720 MVP Moderator

I got into a situation where I need to access AKS cluster ,so I have added below required permission by adding myself to the group and given necessary permission but getting below error

ERROR :The client 'abc' with object id 'XXXXXXXXXXXXXXXXXX' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourceGroups/read' over scope '/subscriptions/'XXXXXXXXXXXXXXXXXX'/resourceGroups/XXXX-014-aks-rg' or the scope is inis invalid. If access was recently granted, please refresh your credential

Please check below Images

Error Image

User's image

Permission Image

User's image

Action Already tried:

Clear the browser cache , sign out an sign in
Check with other members of the group they can access with no errors

Please help

1 answer

Your answer

Answer 1

Babafemi Bulugbe 4,025 MVP Volunteer Moderator

Hello Deepanshu katara,

Trust you are doing great.

I noticed from the error you posted that you do not have the permission needed.

You have been assigned a role on the AKS but not on the resource group where the AKS is.

You need a read permission on the Resource group (corp-dev-014) where the AKS is.

User's image

Let me know if this helps.

Babafemi

Deepanshu katara 16,720 Reputation points MVP Moderator

2024-05-06T12:16:10.6633333+00:00

Hi Babafemi,

Thanks for your response but if you see the 2nd image I have pasted in my question you can see that I also have reader permission at RG level, for your ref
Deepanshu katara 16,720 Reputation points MVP Moderator

2024-05-06T12:16:36.76+00:00
Babafemi Bulugbe 4,025 Reputation points MVP Volunteer Moderator

2024-05-06T12:25:41.4966667+00:00

Hello Deepanshu katara

This screenshot shows IAM on the Kubernetes Service and not the RG.

I should see something like what it is in the screenshot below
Deepanshu katara 16,720 Reputation points MVP Moderator

2024-05-06T12:41:10.41+00:00

Ok ,please check below then
Babafemi Bulugbe 4,025 Reputation points MVP Volunteer Moderator

2024-05-06T13:12:53.0766667+00:00

If this is the case, then just wait a while or use Incognito....as you have the necessary permission to perform this
Deepanshu katara 16,720 Reputation points MVP Moderator

2024-05-06T15:28:19.3766667+00:00

Even incognito didn’t helped, no issues take your time
Deepanshu katara 16,720 Reputation points MVP Moderator

2024-05-08T06:24:48.0166667+00:00

Any update on this if possible , Thank!
Babafemi Bulugbe 4,025 Reputation points MVP Volunteer Moderator

2024-05-08T06:34:08.1533333+00:00

Looking at the error again, I am still of the opinion that the necessary permission hasn't been assigned. Check the error screenshot and the last screenshot you posted, the resource group names are different. In the error screenshot, the resource group referenced is corp-dev-014-aks-rg. On the screenshot where I asked for to see your permission on the resource group, the resource group name ended with cc-rg.
Deepanshu katara 16,720 Reputation points MVP Moderator

2024-05-08T06:45:08.3666667+00:00

I think babafemi you are missing something here if you clearly see the error screenshot what you are saying is not a RG but a subscription , please check once I have highlighted it there is no RG with name corp-dev-014-aks-rg. , we have subscription with name corp-dev-014 and RG with name corp-dev-014-ikcy-cc-rg.

Thanks
Babafemi Bulugbe 4,025 Reputation points MVP Volunteer Moderator

2024-05-08T07:06:02.67+00:00

Hello Deepanshu katara,

If this is the case, then there is something wrong with the scope and not the permission based on this screenshot.

Now we need to check the reason for this denial thoroughly.

Can you check if you have a dual account?

Babafemi
Deepanshu katara 16,720 Reputation points MVP Moderator

2024-05-08T13:22:34.91+00:00

I only have single account
vipullag-MSFT 26,487 Reputation points Moderator

2024-05-09T04:23:41.9533333+00:00

Hello Deepanshu katara,

We noticed your feedback that the above answer was not helpful.

Thank you for taking time to share feedback.

You have tried all the suggestions shared by Babafemi, and are still running into issues. I would recommend you to open a azure support case. Support team will be able to check and help on this.
Deepanshu katara 16,720 Reputation points MVP Moderator

2024-05-09T07:04:22.29+00:00

Ok sure , Thanks!

Share via

The client 'abc' with object id 'XXXXXXXXXXXXXXXXXX' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourceGroups/read' over scope '/subscriptions/'XXXXXXXXXXXXXXXXXX'/resourceGroups/XXXX-014-aks-rg' or the scope is in

1 answer

Your answer